CVE-2026-35273
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Description
CVE-2026-35273 is a critical missing-authentication vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Updates Environment Management). It allows an unauthenticated attacker with network access over HTTP to fully compromise PeopleSoft Enterprise PeopleTools, resulting in takeover of the affected system. Supported versions 8.61 and 8.62 are affected. Rated CVSS 9.8 (Critical) with high impact to confidentiality, integrity, and availability, CVE-2026-35273 is listed in the CISA KEV catalog and has a known association with ransomware campaigns. Because this missing-authentication vulnerability is easily exploitable without credentials and leads to complete takeover of a core enterprise application, organizations running PeopleSoft PeopleTools should patch on an emergency basis.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | peoplesoft enterprise peopletools | 8.61; 8.62 |
References
- https://www.oracle.com/security-alerts/alert-cve-2026-35273.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273(Third Party Advisory, US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CVE-2026-35273 is classified under CWE-306 — Missing Authentication for Critical Function. The Environment Management component of PeopleSoft PeopleTools exposes critical functionality over HTTP without requiring a proven identity, so an unauthenticated attacker can reach operations that should be restricted to authorized users. This complete absence of authentication is what makes the vulnerability easily exploitable and able to result in full takeover.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2026-35273 carries a CVSS 3.1 base score of 9.8 (Critical). Attack Vector (Network): the component is exploitable remotely over HTTP without physical access. Attack Complexity (Low): Oracle describes it as easily exploitable with no special conditions. Privileges Required (None) and User Interaction (None): no authentication or victim action is needed. Confidentiality, Integrity and Availability (High): a successful attack results in takeover of PeopleSoft Enterprise PeopleTools, exposing and allowing modification of the HR, financial, and identity data these systems typically hold, as well as disruption of the service. With an EPSS score of about 7.5% (94th percentile), confirmed inclusion in the KEV catalog, and a known ransomware association, the business risk is severe and immediate.
Exploit Maturity
CISA has added CVE-2026-35273 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and the KEV entry flags a known ransomware association — meaning the vulnerability is being used in ransomware campaigns. No standalone public exploit link is listed in the references, but the EPSS score of about 7.5% (94th percentile) indicates a high probability of exploitation. The combination of confirmed exploitation, ransomware usage, and an unauthenticated network attack surface makes immediate remediation essential.
Remediation
- Follow CISA's required action and apply Oracle's fix as documented in the Oracle security alert for CVE-2026-35273 by the KEV due date.
- Upgrade or patch affected PeopleSoft Enterprise PeopleTools 8.61 and 8.62 installations to the fixed level Oracle provides for the Updates Environment Management component.
- As an interim mitigation, restrict network and HTTP access to PeopleTools and the Environment Management component to trusted administrative networks only.
- Given the known ransomware association, review logs for unauthenticated access to the Environment Management endpoints and for indicators of compromise, and verify backups are intact and offline.
- As long-term hardening, require authentication on every critical PeopleTools function and avoid exposing administrative components to untrusted networks (per the CWE-306 guidance).
Technical Details
The vulnerability is an instance of CWE-306 (Missing Authentication for Critical Function): the Updates Environment Management component of PeopleSoft PeopleTools does not authenticate requests to functionality that should require a verified identity. As reflected in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, an unauthenticated attacker with HTTP access sends requests directly to the exposed component and, because no credential check stands in the way, can drive operations that lead to full takeover of PeopleSoft Enterprise PeopleTools. The lack of authentication on a critical, network-reachable function is the entire basis for the unauthenticated compromise.
Frequently Asked Questions
Is CVE-2026-35273 being actively exploited?
Yes. CVE-2026-35273 is listed in CISA's Known Exploited Vulnerabilities catalog, and the KEV entry indicates a known ransomware association. Its EPSS score of about 7.5% (94th percentile) further supports a high likelihood of exploitation.
What products are affected by CVE-2026-35273?
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 are affected, specifically the Updates Environment Management component.
How do I fix CVE-2026-35273?
Apply Oracle's fix as documented in the Oracle security alert for CVE-2026-35273 and upgrade the affected 8.61 and 8.62 installations. Restrict HTTP access to the Environment Management component until patched.
How severe is CVE-2026-35273?
It is rated Critical with a CVSS 3.1 base score of 9.8. Because it is unauthenticated, easily exploitable over the network, confirmed as actively exploited, and associated with ransomware, it is among the highest-priority vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.